yt-dlp CVE-2025-54072

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:32 vuln.today

DescriptionCVE.org

Alpine Linux: yt-dlp fixed in 0-r0

AnalysisAI

yt-dlp, the open-source video download utility, has been patched in Alpine Linux's package repository (version 0-r0). The underlying vulnerability details - including its exact nature, affected functionality, and attacker-reachable impact - are not disclosed in available intelligence sources. The Alpine vendor advisory references a fix but provides no description of the flaw, its severity class, or exploitation conditions. EPSS places this at the 66th percentile relative to other CVEs despite a low absolute probability (0.49%), and no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

yt-dlp is a feature-rich command-line tool derived from youtube-dl, used for downloading media from YouTube and hundreds of other video platforms. It is distributed as an Alpine Linux package. The fix version '0-r0' is an atypical Alpine package version string - standard Alpine versioned releases follow patterns like '2025.x.x-rx'; '0-r0' may indicate a package rebuild, version reset, or a placeholder introduced during the patching process, which further limits confidence in identifying the exact upstream yt-dlp release that resolves this issue. No CWE is assigned, so the root cause class (e.g., command injection, path traversal, SSRF, insecure deserialization) cannot be determined from available data. No CPE strings were provided.

Affected ProductsAI

The affected product is yt-dlp as packaged in Alpine Linux. The exact vulnerable version range is not disclosed in available intelligence. The fix is reported as Alpine package version 0-r0 per the Alpine vendor source. No upstream yt-dlp version range, no CPE strings, and no vendor advisory URL were provided in the available data.

RemediationAI

Update the yt-dlp Alpine Linux package to version 0-r0 or later using the standard Alpine package manager: 'apk upgrade yt-dlp'. Note that the fix version string '0-r0' is atypical and the patched upstream yt-dlp release version has not been independently confirmed from available data - verify against the Alpine package repository changelog or the yt-dlp GitHub releases for the corresponding upstream fix. No workarounds or compensating controls can be specifically recommended without knowledge of the vulnerability class. If yt-dlp is used in automated or server-side contexts, consider restricting its execution environment (e.g., sandboxing, dropping capabilities) as a general defense-in-depth measure until full details are disclosed.